Analysis
- max time kernel
178s - max time network
131s - platform
android_x86 - resource
android-x86-arm-20240611.1-en - resource tags
- submitted
12/06/2024, 22:40
General
- Target a2bee58ea095c9a9fa25fc9d56484085_JaffaCakes118.apk
- Size 6.6MB
- Sample240612-2ln2cstcmb
- SHA256 95475726606bbde9dc57f0c759c9546d0a9ab2a5b4c4a33fddd559d5cce44583
Malware Config
Signatures
- Checks if the Android device is rooted. 1 TTPs 2 IoCs
- Loads dropped Dex/Jar 1 TTPs 11 IoCs
Runs executable file dropped to the device during analysis.
- Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps) 1 TTPs
- Queries information about running processes on the device 1 TTPs 2 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
- Reads the content of photos stored on the user's device. 1 TTPs 1 IoCs
- Acquires the wake lock 1 IoCs
- Queries information about active data network 1 TTPs 2 IoCs
- Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
- Queries the mobile country code (MCC) 1 TTPs 2 IoCs
- Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 2 IoCs
- Uses Crypto APIs (Might try to encrypt user data) 1 TTPs 2 IoCs
- Checks memory information 2 TTPs 1 IoCs
Processes
-
com.mobile.indiapp1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Reads the content of photos stored on the user's device.
- Acquires the wake lock
- Queries information about active data network
- Queries information about the current Wi-Fi connection
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
- Checks memory information
-
sh2⤵
-
chmod 777 /data/user/0/com.mobile.indiapp/files/daemon3⤵
-
-
-
/system/bin/ndk_translation_program_runner_binfmt_misc /data/user/0/com.mobile.indiapp/files/daemon /data/user/0/com.mobile.indiapp/files/daemon /data/user/0/com.mobile.indiapp am startservice -n com.mobile.indiapp/com.mobile.indiapp.service.NineAppsService --user 0 api.9apps.com /client.log?t=uninstall&p=logtype=10010`platformId=1`app=811`ch_code=5`ver=3.3.2.700`versionCode=154`utdid=Zmoj5/oZbRADACZuE+4yLKdl`sid=0000e1f6cf1a-618d-4de5-8c3f-edd4a56184da1718232039824`f=94_2_0_0_02⤵
-
-
com.mobile.indiapp:worker1⤵
- Checks if the Android device is rooted.
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about active data network
- Queries the mobile country code (MCC)
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Uses Crypto APIs (Might try to encrypt user data)
Network
MITRE ATT&CK Mobile v15
Defense Evasion
Download New Code at Runtime
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
libsgmainso-5.3.7011.so.tmp
libuninstall.so
sdk.jar.cur.prof
sdk.jar
11gpsdfe_1718232044339004179.wa
12hqtegf_1718232044946004179.wa
13irufhg_1718232058102004179.wa
journal.tmp
unique
WaSession.db-journal
WaSession.db-shm
WaSession.db-shm-journal
WaSession.db-shm-wal
WaSession.db-wal
WaSession.db-wal-journal
WaSession.db-wal-wal
WaValue.db-journal
WaValue.db-shm-journal
WaValue.db-shm-wal
WaValue.db-wal
WaValue.db-wal
WaValue.db-wal-journal
WaValue.db-wal-wal
clean_white_list.db-journal
clean_white_list.db-wal
common_db
common_db-journal
common_db-shm
common_db-shm-journal
common_db-shm-wal
common_db-wal
common_db-wal-journal
common_db-wal-wal
dYJmUhl-journal
dYJmUhl-wal
downloader-journal
downloader-shm-journal
downloader-shm-wal
downloader-wal
downloader-wal-journal
downloader-wal-wal
message-shm
message-shm-journal
message-shm-wal
message-wal
message-wal-journal
message-wal-wal
pkgcache_basic.db
pkgcache_basic.db
pkgcache_basic.db-journal
pkgcache_basic.db-wal
.YFlurrySenderIndex.info.AnalyticsData_5TG4JGVTYX3S34VZQT7N_216
.YFlurrySenderIndex.info.AnalyticsMain
.yflurrydatasenderblock.060d6ae1-a43b-4b8a-b594-4a2a508a6acd
daemon
home_app_data_us.json
hot_word_data_us.json
apks
paths
ECBMD-4179-1718232052750
ECBMD-4179-1718232054645
ECBMD-4179-1718232055603
ECBMD-4179-1718232061590
ECBMD-4179-1718232061919
ECBMD-4179-1718232062034
ECBMD-4179-1718232092498
ECBMD-4179-1718232093467
ECBMD-4179-1718232094136
ECBMD-4179-1718232094553
ECBMD-4179-1718232094741
ECBMD-4179-1718232095168
ECBMD-4179-1718232095852
ECPMD-4179-1718232054512
PBUD-4179-1718232054692
libsgmain_315561600000.zip
sdk.jar
ContextData.xml
ContextData.xml
ContextData.xml
322a309482c4dae6
Alvin2.xml
Alvin2.xml
journal.tmp